A client saw a message on her PC that says, "Jason-PC disconnected" - does that mean that someone was on her computer?

We had one of our legal advisors at a business yesterday and just before she shut down her computer she said she saw a message box pop up in the bottom right hand corner of her screen that says, "Jason-PC Disconnected". Keep in mind, when she got there yesterday their IT guy put her on their network so that she could 1) use the web and 2) print to their shared printer.

I remote logged into her computer this morning and saw that "File Print Sharing" was on... so my question is, does that mean that anyone on their network would be able to see her files? If so, would it really give her a message that says says someone disconnected? I've never seen that message before and I'm trying to figure out if I should be concerned.. and/or what to do about it. I did turn OFF file / print sharing while i was logged in.

Did the clients IT department remote to her at any time? It sounds like there was a Damware or similar software session going on, and when she logged off, the network connection closed and disconnected the remote session.

Even if they had shared out her hard drive for some reason, you wouldn't actively see when someone was on like that, you'd have to go to shared folders -> open shares to see who was acessing files on your computer. If you want peace of mind though, you can go to Shares under shared folders and remove the default c$ admin share, as well as make sure nothing else has been shared out

Was she put on a Wireless network? If so there is a slight chance that the wireless network was named Jason-PC. Just a shot in the dark there. Now, why someone would name an SSID Jasons-PC is beyond me, but I have seen stranger SSID's.

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

Check the event log. Look under the security and under the system log (hell application log while you are at it to see if there were any unusual applications launched around the time that she was logged in. Applications that she would not normally launch in her day to day operations, or maybe see if there are any entries for remote assist, dameware, etc.

"Jason-PC" was probably another computer on the network. It may not have been snooping, as there are applications that automatically look for shared files. iTunes searches the network for other iTunes users.

Then again...if it was disconnected, that means it was actually connected to content.

Also, it didn't have to be a remote connection like RDP or VNC. You can connect to a file share or administrative share without installing/running software.

0

Featured Post

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

Securing your business data in current era should be your biggest priority. Numerous people are unaware of the fact that insiders commit more than 60 percent of security breaches. You need to figure out the underlying cause and invoke your potential…

It’s a season to be thankful, and we’re thankful for users like you who engage on site, solve technology problems, and network with others in the industry. What tech are we most thankful for? Keep reading.

Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…